CISA adds Log4Shell flaw to the Known Exploited Vulnerabilities Catalog

JBoss Seam 2 (jboss-seam2), as used in Red Hat JBoss Enterprise Application Platform (EAP) 4.3.0 for Red Hat Linux, is vulnerable to remote code execution caused by an input validation flaw (CWE-20) in its processing of Expression Language (EL) expressions. A remote attacker triggers the flaw by sending crafted input containing EL expressions that the Seam framework evaluates without sufficient validation; exploitation succeeds only when the Java Security Manager is not properly configured, which is the typical default. Successful exploitation lets the attacker run arbitrary code with the privileges of the JBoss server process, providing a foothold on the host and access to any back-end systems the application server can reach. Organizations still running legacy Red Hat JBoss EAP 4.3.0 / Seam 2 deployments, particularly internet-facing ones, are in scope, and the flaw is in the CISA Known Exploited Vulnerabilities (KEV) catalog, obliging U.S. federal agencies to apply vendor updates. It was added to KEV on 2021-12-10, confirming in-the-wild exploitation (ransomware use unknown); it carries a very high EPSS of 83.4% (100th percentile) and no public proof-of-concept is known.

Do: Apply Red Hat's patched jboss-seam2 update for JBoss Enterprise Application Platform 4.3.0 per vendor instructions (RHSA-2010:0574); where immediate patching is not possible, properly configure the Java Security Manager for the JBoss JVM — the flaw is only exploitable when it is not properly configured — and restrict untrusted EL input and internet exposure of Seam-based applications. Inventory legacy JBoss EAP 4.x/Seam 2 hosts, prioritize internet-facing Linux servers given active Linux-targeting threats such as the SpeakUp backdoor, and check those hosts for signs of compromise. Remediation is required for U.S. federal agencies under CISA's KEV requirement (listed 2021-12-10).

CVE-2017-12149 is a critical (CVSS 9.8) unauthenticated deserialization flaw in the doFilter method of the ReadOnlyAccessFilter of the HTTP Invoker in JBoss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 (CWE-502). Because the filter does not restrict which classes it will deserialize, a remote, unauthenticated attacker can send crafted serialized data to the HTTP Invoker endpoint over the network and have the server deserialize it. Successful exploitation yields arbitrary code execution with the privileges of the JBoss server process, giving attackers a foothold for full system compromise. Any organization running the affected JBoss Application Server/EAP 5.2 with the HTTP Invoker enabled is affected. The flaw is actively exploited: it is in CISA's Known Exploited Vulnerabilities Catalog (added 2021-12-10) with known ransomware use, EPSS estimates a 90.7% chance of exploitation within 30 days, and reporting links it to campaigns by the ChamelGang APT group against energy and aviation targets.

Do: Per the KEV required action, apply the vendor's updates to Red Hat JBoss EAP following Red Hat's instructions. As an interim mitigation, restrict or remove access to the HTTP Invoker endpoints (for example, block or firewall the invoker paths so they are not reachable by untrusted clients). Prioritize patching on internet-facing JBoss servers and hunt for signs of exploitation, given the known ransomware use.

Embedthis GoAhead web servers before version 3.6.5 initialize the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function (cgi.c), which allows an attacker to inject dynamic-loader variables such as LD_PRELOAD when CGI is enabled and the CGI program is dynamically linked. By POSTing a shared-object payload in the request body and referencing it through /proc/self/fd/0, the attacker causes the glibc dynamic linker to load and execute their code, resulting in unauthenticated remote code execution with the privileges of the web server. The attack requires no privileges or user interaction, but only works on targets with CGI enabled and a dynamically linked CGI binary, which limits the exploitable share of GoAhead's very large embedded-device footprint. Affected deployments include Embedthis GoAhead prior to 3.6.5 across embedded and IoT devices, as well as Oracle Integrated Lights Out Manager (ILOM) service processors that ship the affected GoAhead code. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2021-12-10, and EPSS assigns a 96.3% probability of exploitation within 30 days.

Do: Upgrade Embedthis GoAhead to version 3.6.5 or later per vendor instructions, and apply the ILOM updates Oracle provides in its security advisories for Integrated Lights Out Manager. Where upgrading is not immediately possible, disable CGI or ensure CGI programs are statically linked so LD_PRELOAD cannot be abused, and prioritize patching internet-exposed devices. Because this vulnerability is on the CISA KEV catalog, use asset inventories and exposure scans to confirm no remaining unpatched GoAhead instances are reachable from the internet.

CVE-2019-0193 is a code injection flaw (CWE-94) in the DataImportHandler (DIH), an optional but popular Apache Solr module used to pull in data from databases and other sources. The DIH configuration can be supplied at request time via the 'dataConfig' parameter (used by the DIH admin screen's debug mode), and because such configs can embed scripts, a crafted parameter allows arbitrary code execution. A successful attacker gains remote code execution within the Solr process (C:H/I:H/A:H); the 7.2 CVSS reflects that high-privilege access to the Solr admin/DIH interface is normally required, though internet-exposed instances without authentication remove that barrier. Any Solr deployment using DIH on versions before 8.2.0, when the 'enable.dih.dataConfigParam' opt-in Java system property was introduced, is affected, including Solr packages shipped with Debian Linux. Exploitation is confirmed in the wild (added to the CISA KEV on 2021-12-10), EPSS assigns an 83.5% 30-day exploitation probability (100th percentile), and no public PoC is catalogued.

Do: Upgrade Apache Solr to 8.2.0 or later, or apply vendor updates per the CISA KEV required action; if upgrading is not immediately possible, restrict access to the Solr admin UI and the dataimport handler and leave the 'enable.dih.dataConfigParam' property disabled unless needed. Check access logs for requests to the dataimport handler containing a 'dataConfig' parameter as an indicator of probing or exploitation. Ransomware linkage is listed as unknown, so treat any exposed instance as a potential foothold.

mongo-express, the web-based administration interface for MongoDB, is vulnerable to remote code execution (CWE-94 code injection) in versions before 0.54.0. The flaw stems from a misuse of the Node.js `vm` dependency: endpoints that invoke the `toBSON` method evaluate attacker-supplied input via `exec`-style commands outside a properly sandboxed environment, so an authenticated web-UI user (CVSS PR:L) can trigger the flaw over the network with no user interaction. Successful exploitation yields arbitrary command execution on the host running mongo-express, typically with access to the MongoDB instance and potentially the surrounding container or server. Any mongo-express deployment prior to 0.54.0 is affected, particularly instances exposed to the internet or shared networks where default or weak credentials are in use. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities Catalog on 2021-12-10, EPSS assigns an ~84.7% probability of exploitation within 30 days, and public proof-of-concept references are available.

Do: Upgrade mongo-express to version 0.54.0 or later, per CISA's required action to apply vendor updates. Restrict the mongo-express web UI to trusted networks and set strong, non-default credentials, since triggering the flaw requires an authenticated session. Inventory Node.js and Docker-based deployments running mongo-express, especially internet-facing ones, and patch them promptly as this flaw is on CISA's Known Exploited Vulnerabilities list.

CVE-2019-13272 is an improper privilege management flaw in the Linux kernel's ptrace_link function (kernel/ptrace.c), present in kernels before 5.1.17, in which the credentials of a process requesting a ptrace relationship are mishandled. A local attacker triggers it by stepping into a parent-child process chain where a privileged parent drops privileges and calls execve, typically by abusing Polkit's pkexec helper with PTRACE_TRACEME; contributing factors include an object lifetime issue and incorrect marking of the ptrace relationship as privileged. Successful exploitation grants the attacker full root-level privileges on the host, and the object lifetime bug can in some cases cause a system panic. Any Linux system running an unpatched kernel is affected, spanning the upstream kernel and distributions such as Debian, Fedora, Ubuntu, Red Hat Enterprise Linux and its variants, as well as NetApp AFF A700s firmware. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-12-10), has multiple public proof-of-concept exploits, and carries a high exploitation probability (EPSS ~52%), so defenders should treat it as an active exploitation risk.

Do: Upgrade the Linux kernel to 5.1.17 or later, or install the backported kernel update from your distribution (Debian, Ubuntu, Fedora, Red Hat) and NetApp's fixed firmware for AFF A700s, per CISA's required action to apply vendor updates. Where patching is delayed, SELinux with deny_ptrace may serve as a usable mitigation in some environments. Prioritize hosts that expose local shells to untrusted users and that have Polkit's pkexec installed, and verify the running kernel version (not just the installed package) on each system.

CVE-2019-7238 is an incorrect access control flaw in Sonatype Nexus Repository Manager versions before 3.15.0 that is triggerable over the network by unauthenticated attackers with no user interaction, earning a critical CVSS 3.1 score of 9.8 with high impact on confidentiality, integrity, and availability. Any attacker who can reach a vulnerable instance can gain high-impact access to the repository server, consistent with full compromise of the system and the software artifacts it hosts and serves. All deployments running Nexus Repository Manager releases prior to 3.15.0 are affected, whether exposed to the internet or hosted internally as part of build and CI/CD pipelines. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities Catalog on 2021-12-10 (ransomware use unknown), EPSS assigns a 77.1% probability of exploitation within 30 days, no public PoC is known, and the related WatchBog Linux botnet headlines are consistent with the cryptomining campaigns that targeted Nexus Repository Manager deployments in this period.

Do: Upgrade all Nexus Repository Manager deployments to version 3.15.0 or later per Sonatype and CISA instructions, and inventory any 3.x instances still running older releases, prioritizing internet-facing ones. Restrict network access to the Nexus service to trusted networks and users, and check instances for signs of compromise such as unexpected cryptomining processes or outbound connections to Pastebin, consistent with the botnet campaigns referenced in related reporting.

CVE-2020-17463 is a SQL injection flaw (CWE-89) in FUEL CMS 1.4.7, exploitable through the 'col' parameter on the /pages/items, /permissions/items, and /navigation/items endpoints. Because the parameter is not properly sanitized, a remote, unauthenticated attacker can inject arbitrary SQL via crafted HTTP requests to these URLs with no user interaction or privileges required. Successful exploitation can expose or alter the contents of the CMS database, and under some database configurations may enable further attacks against the backend. Any installation running FUEL CMS 1.4.7 is affected, with internet-exposed instances at greatest risk. The flaw carries a critical CVSS 3.1 score of 9.8, a top-percentile EPSS score (89.7% probability of exploitation within 30 days), a public proof-of-concept, and was added to CISA's Known Exploited Vulnerabilities Catalog on 2021-12-10, indicating known in-the-wild exploitation; ransomware association is unknown.

Do: Upgrade FUEL CMS to a release newer than 1.4.7 per the vendor's instructions, as required by the CISA KEV catalog entry. If patching is not immediate, restrict or filter the 'col' parameter on /pages/items, /permissions/items, and /navigation/items (e.g., via WAF rules) and confirm the CMS database account follows least-privilege principles. Review web and database logs for anomalous queries or SQL injection payloads targeting these endpoints, and verify internet-exposed instances are patched given the KEV listing and high EPSS score.

CVE-2020-8816 is an OS command injection flaw (CWE-78) in Pi-hole's web dashboard, AdminLTE (Pi-hole Web), version 4.3.2. A privileged dashboard user can trigger remote code execution by adding a crafted DHCP static lease, causing injected commands to run on the Pi-hole host. An attacker with an authenticated admin session gains code execution on the DNS appliance, yielding high impact on confidentiality, integrity and availability of that system and the networks whose DNS it handles. Any Pi-hole deployment running the affected AdminLTE web interface is affected, with the greatest risk where the admin panel is reachable from networks an attacker can access. The flaw is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2021-12-10), has a public proof-of-concept, and carries a very high EPSS (~78% probability of exploitation within 30 days), so it should be treated as actively exploited.

Do: Upgrade Pi-hole Web (AdminLTE) to any release newer than v4.3.2 per vendor instructions and treat this as urgent because the flaw is in CISA's KEV. In the interim, keep the admin dashboard off the public internet (restrict to LAN/VPN with strong authentication), review configured DHCP static leases for injected commands, and check web server logs for evidence of exploitation.

Realtek's Jungle SDK, a software development kit used to build firmware for a wide range of consumer and small-office networking devices (most notably routers), contains multiple memory corruption vulnerabilities that can be triggered remotely over the network; public disclosure tied the flaws to unauthenticated network-facing components bundled with the SDK, such as its UPnP and DHCP handling. An attacker who sends crafted packets to a vulnerable device can corrupt memory and, per the associated weakness types (CWE-78 command injection, CWE-138 improper neutralization), end up executing arbitrary code or operating-system commands with the privileges of the vulnerable service, effectively taking over the device. Because the SDK is licensed into many vendors' products rather than sold as a standalone application, exposure spans numerous router and embedded-device vendors, and end users may not even know their device relies on it. Exact affected SDK version ranges and per-vendor firmware lists were not specified in the available data, so defenders should rely on the latest vendor advisories. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2021-12-10, indicating confirmed exploitation in the wild; ransomware use is unknown and no public proof-of-concept is flagged in the available data.

Do: Per CISA's required action, apply firmware updates per your device vendor's instructions, since patches are distributed by the vendors that build on the SDK rather than by Realtek directly. Identify whether your router or embedded device uses Realtek Jungle SDK-based firmware (check the vendor's model/advisory pages) and prioritize updating internet-facing devices. Where patched firmware is not yet available, restrict direct internet exposure (firewall the WAN side) and disable or limit UPnP/DHCP-related exposed services if the vendor supports doing so, while monitoring vendor advisories.

CVE-2021-44168 is a download-of-code-without-integrity-check vulnerability (CWE-494) in the "execute restore src-vis" command of Fortinet FortiOS. A local, authenticated attacker who can invoke this command can supply a specially crafted update package that the device processes without verifying its integrity, allowing arbitrary files to be downloaded on the device. Per the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L), the local privileges and crafted package are the only prerequisites, and the potential impact is high for confidentiality, integrity, and availability. Any organization running FortiOS versions before 7.0.3 is affected. The flaw is confirmed to be exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2021-12-10 (the same catalog update that added Log4Shell), though no public proof-of-concept is known, EPSS is 0.9%, and ransomware use is unknown.

Do: Upgrade FortiOS to 7.0.3 or later per Fortinet's vendor instructions, as required by the CISA KEV listing. Until patched, restrict local/CLI administrative access to trusted operators, since exploitation requires an authenticated local session, and monitor for use of the "execute restore src-vis" command with untrusted or unexpected packages.

Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days.

Do: Inventory all Java applications and dependencies for Apache Log4j2 and apply the vendor's patched updates, or remove affected assets from the network, as required by CISA's KEV catalog. Where updates are not yet available, use the temporary mitigations in CISA's ED-22-02 recommended-mitigation guidance, such as disabling message lookups, only until patches are applied. Prioritize internet-facing and business-critical systems and hunt for exploitation activity given known ransomware use.

CVE-2021-44515 is an authentication bypass in Zoho ManageEngine Desktop Central and Desktop Central MSP that allows an unauthenticated attacker to execute arbitrary code on the central management server. It is triggered by sending crafted requests to the Desktop Central server without valid credentials, bypassing the login entirely. Successful exploitation yields code execution on the management server, which typically holds broad credentials and can push commands and agents to every managed endpoint, making it a strong foothold for further network compromise. Any organization running an on-premises Desktop Central or Desktop Central MSP server is affected, particularly where the server is internet-exposed. The flaw was under active exploitation when disclosed in December 2021: CISA added it to the KEV on 2021-12-10, EPSS shows a 99.9% 30-day exploitation probability, and no public PoC is known.

Do: Upgrade Desktop Central and Desktop Central MSP to build 10.1.2228.11 or later per ManageEngine's advisory, verifying the running build on the server's About page. Restrict internet access to the Desktop Central web console (default ports 8020/8383) and review server logs for unauthenticated access or unexpected code execution. Because a compromised management server often holds domain-level credentials, rotate credentials stored on or used by the server and watch managed endpoints for signs of follow-on compromise.